/**
 * Helpers for the agent-memory bearer secret at `~/.olam/memory-secret`.
 *
 * Pattern mirrors `~/.olam/auth-secret`:
 *   - 0600 mode enforced on every write
 *   - atomic write via tmp + rename
 *   - generated on first call to `ensureMemorySecret()`
 *
 * Phase C's `cloud-memory-secret` reuses the path-arg form
 * (`ensureSecretAtPath` / `readSecretAtPath`) so local + cloud share
 * the same code path.
 *
 * Plan reference: docs/plans/olam-agent-memory-distributed/phase-a-tasks.md A3
 */
export declare const MEMORY_SECRET_PATH: string;
/**
 * Default cloud-mode secret path. Phase C C2.
 *
 * Mirrors the local pattern (0600, 64 hex chars). When `.olam/config.yaml`
 * carries `memory.cloud.secret_ref`, that wins over this default. The
 * config-resolver (C4) handles the precedence; this constant is the
 * fall-through when the operator doesn't override.
 */
export declare const CLOUD_MEMORY_SECRET_PATH: string;
export declare const SECRET_LEN_BYTES = 32;
/** Generate a 64-char hex secret. */
export declare function generateSecret(): string;
/**
 * Write `value` to `path` atomically with mode 0600. Parent directory
 * created with default mode if absent.
 */
export declare function writeSecretAtPath(path: string, value: string): void;
/**
 * Read `path` as a string. Returns `null` if missing. Warns to stderr
 * if mode is not 0600 (caller decides whether to proceed).
 */
export declare function readSecretAtPathOrNull(path: string): string | null;
/** Read `path` or throw if missing. */
export declare function readSecretAtPath(path: string): string;
/**
 * Ensure `~/.olam/memory-secret` exists with mode 0600. Generates a
 * fresh 64-char hex secret on first call. Idempotent.
 */
export declare function ensureMemorySecret(path?: string): string;
/** Read the local-mode memory secret (no-throw shape). */
export declare function readMemorySecretOrNull(path?: string): string | null;
/** Read the local-mode memory secret (throw shape). */
export declare function readMemorySecret(path?: string): string;
/**
 * Rotate the secret: generate fresh value, atomically replace the file,
 * return the new value. Caller is responsible for restarting any
 * running memory service so it picks up the new value.
 */
export declare function rotateMemorySecret(path?: string): string;
/** Convenience: are we wired for local-mode memory? */
export declare function hasMemorySecret(path?: string): boolean;
/**
 * Read the cloud-mode bearer secret. Returns `null` if the file is absent
 * (the common case when the operator hasn't run `olam memory mode cloud`
 * yet). Warns to stderr on mode != 0600 but still returns the value —
 * caller decides whether to proceed.
 */
export declare function readCloudMemorySecretOrNull(path?: string): string | null;
/** Throws when the cloud secret is absent — use only when caller has verified mode is cloud. */
export declare function readCloudMemorySecret(path?: string): string;
/** Atomic write 0600. Caller supplies the value (cloud secrets are operator-prompted, not generated). */
export declare function writeCloudMemorySecret(value: string, path?: string): void;
/** Convenience: is a cloud secret on disk? */
export declare function hasCloudMemorySecret(path?: string): boolean;
//# sourceMappingURL=memory-secret.d.ts.map